CVE Vulnerability Catalog

A server-side request forgery vulnerability in Hippo4j through 1.5.0 in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames and ports to trigger outbound GET requests to internal networks and cloud metadata services.

A server-side request forgery vulnerability in MLRun through 1.11.0 in the WebhookNotification handler allows authenticated users to make the API server send arbitrary HTTP requests to internal addresses. Attackers can update a run with a malicious webhook notification that executes when the run reaches a terminal state, enabling requests to internal services, Kubernetes APIs, or cloud metadata endpoints from within the cluster.

An authorization bypass vulnerability in TDuck survey form through version 5.0 in the POST /user/form/data/update endpoint allows authenticated users to overwrite other users' form submission data. Attackers can discover submission identifiers allocated in narrow ranges and modify arbitrary form responses containing personal data by sending update requests without ownership validation.

DataGear through 6.0.0 has a server-side request forgery vulnerability in /dataSet/preview/Http endpoint, allowing unauthenticated attackers to execute arbitrary HTTP requests to internal endpoints and cloud metadata services.

An information disclosure vulnerability in Rallly before 4.15.0 in the polls.get tRPC procedure returns scheduled-event invitee names and email addresses to unauthenticated callers. Attackers can access a poll's urlId from public invite links to retrieve sensitive invitee information regardless of privacy settings.

@fastify/proxy-addr versions 3.0.0 through 5.1.0 accept without error a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix (e.g. ::ffff:10.0.0.0/8 instead of ::ffff:10.0.0.0/104), causing every IPv4 address on the internet to be trusted. As a result, an unauthenticated client can supply an arbitrary X-Forwarded-For header and control the address the application reads. The issue is fixed in version 5.1.1.

A CSRF vulnerability in PbootCMS up to 3.2.24 affects the UserController::del and UserController::mod functions in the User Management component. The attack can be performed remotely, and the exploit has been publicly disclosed. Upgrading to version 3.2.25 resolves the issue.

A weakness has been identified in PbootCMS up to 3.2.22. This affects the function decode_string of the file apps/admin/controller/content/ContentController.php of the component Template Rendering. This manipulation of the argument Title causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

WuzhiCMS up to 4.1.0 has an SSRF vulnerability in the ckditor::saveRemote function in coreframe/app/attachment/index.php (Remote Image Fetch component). Manipulation of source[] parameter leads to server-side request forgery.

code-projects Matrimonial System 1.0 has a SQL injection vulnerability in /search.php (Regular Search component). Parameters sex, mothertongue, maritialstatus, country, state, religion, agemin, agemax are susceptible to manipulation.

@fastify/auth versions 5.0.0 through 5.1.0 have a vulnerability related to strategy evaluation order when using "or" relation with "all" option and a nested AND group. Some requests may be authorized when they should be rejected (e.g., an attacker with a valid API key but not an administrator).

A vulnerability in the Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users. The b2s_calendar_move_post AJAX handler issues an UPDATE against the b2s_posts table using only the attacker-supplied b2s_id primary key with no blog_user_id ownership constraint, allowing any user with the edit_posts capability to reschedule, suppress, or alter the publication state of any other user's scheduled social media post.

A vulnerability in Plate rich-text editor prior to 53.3.11 (and in discontinued 54.0.0-beta builds) affects HTML deserialization APIs that parse supplied HTML strings in the active document. When an application passes untrusted or cross-user HTML, certain HTML attributes can trigger browser behavior before conversion to editor nodes, possibly allowing attacker-controlled script execution in the application's origin when another user loads the deserialized content. Fixed in version 53.3.11.

Backstage (@backstage/plugin-techdocs-node) before versions 1.14.6 and 1.15.0-1.15.4 insufficiently validates mkdocs.yml, which can lead to unintended code execution via unsafe YAML tags, markdown_extensions configuration, and other options.

react/http (part of ReactPHP) versions 0.6.0 through 1.11.1 have a vulnerability in ChunkedDecoder that can enter an infinite loop processing malformed Transfer-Encoding: chunked bodies, potentially freezing a server or client.

ScadaLTS 2.8.1-release-candidate build 0 suffers from an authorization bypass in DWR endpoints. Spring Security gates by URL pattern, but DWR dispatches based on POST body parameters, allowing any authenticated user to invoke any DWR method.

An authenticated blind SQL injection vulnerability in ScadaLTS 2.8.1-release-candidate build 0 in the /api/events/search endpoint. The sortBy array values are concatenated directly into the SQL ORDER BY clause without sanitization, allowing authenticated users with ROLE_USER to perform time-based and boolean-based blind SQL injection to extract arbitrary data, including password hashes of all users.

ScadaLTS 2.8.1-release-candidate build 0 has a remote code execution (RCE) vulnerability via scripting sandbox bypass. The validateScript method in DataSourceEditDwr compiles and executes attacker-supplied JavaScript without authorization, which can be exploited by a low-privileged user.

Avast's sandbox minifilter driver (aswSnx.sys) on Windows has an improper preservation of permissions vulnerability, allowing a local, low-privileged attacker in the sandbox to escape file isolation and escalate to SYSTEM.

PocketBase is an open source web backend written in Go. Prior to 0.22.48 and 0.39.7, PocketBase's panic-recovery middleware covers regular request handling but not internal child and worker goroutines. A panic in one of these internal goroutines can escape recovery and terminate the server process, causing a denial of service.